n9router 0.3.91 → 0.3.94

package/.next/standalone/AGENTS.md

@@ -0,0 +1,136 @@
+# AGENTS.md
+
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
+
+## Project Overview
+
+9Router is a self-hosted AI routing gateway built on Next.js 16 + React 19. It acts as a local proxy between AI coding tools (Codex, Cursor, Codex, Gemini CLI, etc.) and 40+ upstream AI providers. It provides format translation (OpenAI <-> Codex <-> Gemini <-> etc.), multi-account fallback, quota tracking, and usage monitoring. The app exposes an OpenAI-compatible endpoint at `/v1/*` and a web dashboard at `/dashboard`.
+
+## Common Commands
+
+```bash
+# Development
+cp .env.example .env          # first time only
+npm install
+PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev
+
+# Production build
+npm run build
+PORT=20128 HOSTNAME=0.0.0.0 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run start
+
+# Bun alternative
+npm run dev:bun
+npm run build:bun
+npm run start:bun
+
+# Linting
+npx eslint .
+
+# Tests (Vitest must be installed separately in /tmp)
+cd /tmp && npm install vitest    # one-time setup
+cd tests/ && npm test            # run all tests
+
+# Run a single test file
+cd tests/ && NODE_PATH=/tmp/node_modules /tmp/node_modules/.bin/vitest run unit/embeddingsCore.test.js --reporter=verbose
+
+# Docker
+docker build -t 9router .
+docker run -d --name 9router -p 20128:20128 --env-file .env -v 9router-data:/app/data 9router
+```
+
+## Architecture
+
+### Two-Layer Routing Core
+
+The system has a split routing architecture:
+
+- **`src/sse/`** — App-level SSE handlers. Entry point is `src/sse/handlers/chat.js`. Handles model/combo resolution, credential selection, and delegates to the core.
+- **`open-sse/`** — Shared, provider-agnostic routing engine (publishable as a separate package). Contains the core chat orchestration (`handlers/chatCore.js`), provider executors, format translators, and stream utilities.
+
+Request flow: `API route → src/sse/handlers/chat.js → open-sse/handlers/chatCore.js → executor → upstream provider → response translator → client`
+
+### Path Aliases
+
+Defined in `jsconfig.json`:
+- `@/*` → `./src/*`
+- `open-sse` / `open-sse/*` → `./open-sse/*`
+
+### API Routes (`src/app/api/`)
+
+Two categories of API routes:
+
+1. **Compatibility APIs** (consumed by CLI tools):
+   - `/v1/chat/completions` — OpenAI-format chat (main entry point)
+   - `/v1/messages` — Anthropic Codex format
+   - `/v1/responses` — OpenAI Responses API format
+   - `/v1/embeddings`, `/v1/models`, `/v1beta/models`
+   - URL rewrites in `next.config.mjs` map `/v1/*` → `/api/v1/*`
+
+2. **Management APIs** (consumed by the dashboard):
+   - `/api/providers*`, `/api/provider-nodes*` — provider CRUD
+   - `/api/oauth/*` — OAuth flows for provider connections
+   - `/api/keys*`, `/api/combos*`, `/api/models/alias` — API keys, model combos, aliases
+   - `/api/settings/*`, `/api/auth/*`, `/api/usage/*`, `/api/sync/*`
+
+### Format Translation System (`open-sse/translator/`)
+
+Translates between provider-specific formats. Source format is auto-detected from the request endpoint and body shape (see `formats.js`). Supported formats: `openai`, `openai-responses`, `Codex`, `gemini`, `vertex`, `codex`, `antigravity`, `kiro`, `cursor`, `ollama`.
+
+- `translator/request/` — Inbound translation (e.g., `openai-to-Codex.js`)
+- `translator/response/` — Outbound translation (e.g., `Codex-to-openai.js`)
+
+### Provider Executors (`open-sse/executors/`)
+
+Each executor handles a specific provider's auth, API endpoint construction, and credential refresh. Examples: `codex.js`, `cursor.js`, `gemini-cli.js`, `kiro.js`, `iflow.js`, `antigravity.js`, `vertex.js`. The `default.js` executor handles standard OpenAI-compatible providers.
+
+### Combo + Account Fallback
+
+- **Combos**: Named sequences of models tried in order (e.g., subscription → cheap → free)
+- **Account fallback**: Multiple accounts per provider, round-robin with cooldown on failure
+- Logic in `open-sse/services/accountFallback.js` and `src/sse/handlers/chat.js` (combo orchestration)
+
+### Persistence
+
+- **State DB**: `src/lib/localDb.js` → `${DATA_DIR}/db.json` (or `~/.n9router/db.json`). Uses lowdb. Stores provider connections, nodes, aliases, combos, API keys, settings, pricing.
+- **Usage DB**: `src/lib/usageDb.js` → `~/.n9router/usage.json` + `~/.n9router/log.txt`. Independent from `DATA_DIR`.
+
+### Frontend
+
+- Next.js App Router with dashboard pages under `src/app/(dashboard)/dashboard/`
+- Zustand stores in `src/store/` (providerStore, userStore, themeStore, notificationStore)
+- UI components in `src/shared/components/`
+- Tailwind CSS v4 via PostCSS plugin
+
+### MITM Proxy (`src/mitm/`)
+
+Separate child process for intercepting HTTPS traffic from CLI tools. Has its own cert generation (`cert/`), DNS handling, and Express server.
+
+### Cloud Worker (`cloud/`)
+
+Cloudflare Workers deployment for optional cloud sync relay. Has its own `wrangler.toml`, `package.json`, and separate source in `cloud/src/`.
+
+## Key Environment Variables
+
+| Variable | Purpose |
+|----------|---------|
+| `JWT_SECRET` | Required. Signs dashboard auth tokens |
+| `INITIAL_PASSWORD` | Required. Dashboard login password |
+| `DATA_DIR` | Persistent storage directory (default: `~/.n9router`) |
+| `PORT` | Server port (default: 20128) |
+| `NEXT_PUBLIC_BASE_URL` | Public URL for the instance |
+| `REQUIRE_API_KEY` | Enforce API key on `/v1/*` routes |
+| `ENABLE_REQUEST_LOGS` | Log full request/response bodies |
+
+## Testing Notes
+
+- Tests live in `tests/unit/` and use Vitest v4
+- Vitest is installed in `/tmp/node_modules` to avoid conflicts with the root Next.js project's hoisting
+- Test config is at `tests/vitest.config.js` — it aliases `open-sse` to the local package
+- Current coverage: embeddings core, cloud worker handler, OAuth cursor auto-import, OpenAI-to-Codex translation, provider validation, translator request normalization
+
+## CI/CD
+
+- GitHub Actions workflow at `.github/workflows/docker-publish.yml`
+- Triggers on version tags (`v*`) and manual dispatch
+- Builds and pushes Docker image to `ghcr.io`
+- Docker uses multi-stage build with `node:20-alpine`, standalone Next.js output

package/.next/standalone/docs/token_swap_guide.md

@@ -16,4 +16,6 @@ Toàn bộ việc quản lý cũng được gom vào một chỗ. Bạn có th
 
 Cách bật cũng khá đơn giản: khởi động MITM Server, bật DNS Redirect cho Antigravity, rồi bật Token Rotation trong dashboard. Sau đó chỉ cần thêm nhiều account Antigravity vào pool là dùng được.
 
+Nếu chưa muốn thêm account bằng tay, có thể dùng luôn nút import accounts từ Antigravity Management Tools trong phần provider Antigravity để đưa account vào pool nhanh hơn.
+
 Nói ngắn gọn, Antigravity Token Swap không phải là một tính năng kiểu “cho vui”. Nó là thứ giúp biến nhiều account Antigravity thành một lớp quota pool thực thụ, để công việc không bị phụ thuộc vào giới hạn của từng account riêng lẻ.

package/.next/standalone/mitm/server.js

@@ -7,7 +7,7 @@ const { log, err } = require("./logger");
 const { TARGET_HOSTS, URL_PATTERNS, getToolForHost } = require("./config");
 const { DATA_DIR, MITM_DIR } = require("./paths");
 const { isTokenSwapEnabled, getAllActiveConnections, triggerRefreshIfNeeded,
-        setCooldown, setModelCooldown, getTokenSwapStrategy,
+        forceRefreshConnection, setCooldown, setAuthCooldown, setModelCooldown, getTokenSwapStrategy,
         parseQuotaCooldown, markAccountUsed, getConnectionLabel } = require("./tokenPool");
 const { getCertForDomain } = require("./cert/generate");
 const { buildInputOnlyRequestDetail, createTokenSwapUsageObserver, generateDetailId } = require("./usageTracker");
@@ -187,120 +187,144 @@ async function tokenSwapForward(req, res, bodyBuffer, connections, model, strate
 
   for (let i = 0; i < connections.length; i++) {
     const originalConn = connections[i];
-    const conn = await triggerRefreshIfNeeded(originalConn);
-
-    const label = getConnectionLabel(conn);
-    const modelTag = model ? ` model=${model}` : "";
-    const posTag = connections.length > 1 ? ` [${i + 1}/${connections.length}]` : "";
-    const useTag = conn.consecutiveUseCount > 1 ? ` uses=${conn.consecutiveUseCount}` : "";
-    log(`🔑 [token-swap]${posTag} trying "${label}"${modelTag}${useTag}`);
-
-    const swappedHeaders = {
-      ...req.headers,
-      host: targetHost,
-      authorization: `Bearer ${conn.accessToken}`
-    };
-
-    try {
-      const result = await new Promise((resolve, reject) => {
-        const forwardReq = https.request({
-          hostname: targetIP,
-          port: 443,
-          path: req.url,
-          method: req.method,
-          headers: swappedHeaders,
-          servername: targetHost,
-          rejectUnauthorized: false
-        }, (forwardRes) => {
-          if (forwardRes.statusCode === 429 || forwardRes.statusCode === 503) {
-            // Buffer the short error body to parse cooldown duration
-            const chunks = [];
-            forwardRes.on("data", c => chunks.push(c));
-            forwardRes.on("end", () => {
-              const body = Buffer.concat(chunks).toString();
-              resolve({ retry: true, body, statusCode: forwardRes.statusCode });
-            });
+    let conn = await triggerRefreshIfNeeded(originalConn);
+    let authRefreshAttempted = false;
+
+    while (true) {
+      const label = getConnectionLabel(conn);
+      const modelTag = model ? ` model=${model}` : "";
+      const posTag = connections.length > 1 ? ` [${i + 1}/${connections.length}]` : "";
+      const useTag = conn.consecutiveUseCount > 1 ? ` uses=${conn.consecutiveUseCount}` : "";
+      log(`🔑 [token-swap]${posTag} trying "${label}"${modelTag}${useTag}`);
+
+      const swappedHeaders = {
+        ...req.headers,
+        host: targetHost,
+        authorization: `Bearer ${conn.accessToken}`
+      };
+
+      try {
+        const result = await new Promise((resolve, reject) => {
+          const forwardReq = https.request({
+            hostname: targetIP,
+            port: 443,
+            path: req.url,
+            method: req.method,
+            headers: swappedHeaders,
+            servername: targetHost,
+            rejectUnauthorized: false
+          }, (forwardRes) => {
+            if (forwardRes.statusCode === 429 || forwardRes.statusCode === 503 || forwardRes.statusCode === 401) {
+              const chunks = [];
+              forwardRes.on("data", c => chunks.push(c));
+              forwardRes.on("end", () => {
+                const body = Buffer.concat(chunks).toString();
+                const retryType = forwardRes.statusCode === 401 ? "auth" : "quota";
+                resolve({ retry: true, retryType, body, headers: forwardRes.headers, statusCode: forwardRes.statusCode });
+              });
+            } else {
+              resolve({ retry: false, response: forwardRes });
+            }
+          });
+          forwardReq.on("error", reject);
+          if (bodyBuffer.length > 0) forwardReq.write(bodyBuffer);
+          forwardReq.end();
+        });
+
+        if (result.retry && result.retryType === "quota") {
+          const cooldownMs = parseQuotaCooldown(result.body);
+          const cdLabel = cooldownMs ? ` cooldown=${Math.ceil(cooldownMs / 60000)}m` : "";
+          if (strategy === "sticky" && model) {
+            setModelCooldown(conn.id, model, cooldownMs);
+            log(`⚠️ [token-swap] "${label}" → ${result.statusCode} model=${model} quota exhausted${cdLabel}, trying next...`);
           } else {
-            // Success or non-quota error → pipe to client
-            resolve({ retry: false, response: forwardRes });
+            setCooldown(conn.id, cooldownMs);
+            log(`⚠️ [token-swap] "${label}" → ${result.statusCode} account quota exhausted${cdLabel}, trying next...`);
           }
-        });
-        forwardReq.on("error", reject);
-        if (bodyBuffer.length > 0) forwardReq.write(bodyBuffer);
-        forwardReq.end();
-      });
-
-      if (result.retry) {
-        const cooldownMs = parseQuotaCooldown(result.body);
-        const cdLabel = cooldownMs ? ` cooldown=${Math.ceil(cooldownMs / 60000)}m` : "";
-        if (strategy === "sticky" && model) {
-          // Sticky: mark only this account+model as exhausted, not the whole account
-          setModelCooldown(conn.id, model, cooldownMs);
-          log(`⚠️ [token-swap] "${label}" → ${result.statusCode} model=${model} quota exhausted${cdLabel}, trying next...`);
-        } else {
-          // Round-robin: put whole account on cooldown
-          setCooldown(conn.id, cooldownMs);
-          log(`⚠️ [token-swap] "${label}" → ${result.statusCode} account quota exhausted${cdLabel}, trying next...`);
+          break;
         }
-        continue;
-      }
 
-      const newCount = (conn.consecutiveUseCount || 0) + 1;
-      const statusCode = result.response.statusCode || 0;
-      const successModelTag = model ? ` model=${model}` : "";
-      const successStrategyTag = strategy === "sticky" ? ` sticky(use #${newCount})` : ` rr`;
-      log(`✅ [token-swap] "${label}" → ${statusCode}${successModelTag}${successStrategyTag}`);
-      markAccountUsed(conn.id);
-      res.writeHead(statusCode, result.response.headers);
-
-      const detailId = generateDetailId(model);
-      const inputOnlyDetail = buildInputOnlyRequestDetail({
-        detailId,
-        provider,
-        model,
-        connectionId: conn.id,
-        bodyBuffer
-      });
-      fetch("http://127.0.0.1:20128/api/internal/request-detail", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          [INTERNAL_REQUEST_HEADER.name]: INTERNAL_REQUEST_HEADER.value
-        },
-        body: JSON.stringify(inputOnlyDetail)
-      }).catch((detailError) => {
-        err(`[token-swap] failed to create request detail for "${label}": ${detailError.message}`);
-      });
-
-      const usageObserver = createTokenSwapUsageObserver({
-        provider,
-        model,
-        connectionId: conn.id,
-        accountLabel: label,
-        bodyBuffer,
-        contentType: result.response.headers["content-type"] || "",
-        contentEncoding: result.response.headers["content-encoding"] || "",
-        statusCode,
-        detailRecord: inputOnlyDetail,
-        requestStartTime
-      });
-
-      result.response.on("data", (chunk) => {
-        usageObserver.onChunk(chunk);
-        res.write(chunk);
-      });
-      result.response.on("end", () => {
-        res.end();
-        usageObserver.onEnd().catch(() => {});
-      });
-      result.response.on("error", (streamError) => {
-        err(`[token-swap] upstream stream error for "${label}": ${streamError.message}`);
-        if (!res.writableEnded) res.end();
-      });
-      return true;
-    } catch (e) {
-      err(`[token-swap] error for "${label}": ${e.message}`);
-      continue;
+        if (result.retry && result.retryType === "auth") {
+          const retryableAuth = isRetryableAuthFailure(result.statusCode, result.headers, result.body);
+          if (!retryableAuth) {
+            res.writeHead(result.statusCode, result.headers);
+            res.end(result.body);
+            return true;
+          }
+
+          if (!authRefreshAttempted && conn.refreshToken) {
+            authRefreshAttempted = true;
+            log(`⚠️ [token-swap] "${label}" → 401 invalid_token, forcing refresh...`);
+            const refreshResult = await forceRefreshConnection(conn);
+            conn = refreshResult.connection || conn;
+            if (refreshResult.refreshed) {
+              log(`↻ [token-swap] "${label}" refreshed, retrying same account...`);
+              continue;
+            }
+          }
+
+          setAuthCooldown(conn.id);
+          log(`⚠️ [token-swap] "${label}" → 401 invalid_token, trying next...`);
+          break;
+        }
+
+        const newCount = (conn.consecutiveUseCount || 0) + 1;
+        const statusCode = result.response.statusCode || 0;
+        const successModelTag = model ? ` model=${model}` : "";
+        const successStrategyTag = strategy === "sticky" ? ` sticky(use #${newCount})` : ` rr`;
+        log(`✅ [token-swap] "${label}" → ${statusCode}${successModelTag}${successStrategyTag}`);
+        markAccountUsed(conn.id);
+        res.writeHead(statusCode, result.response.headers);
+
+        const detailId = generateDetailId(model);
+        const inputOnlyDetail = buildInputOnlyRequestDetail({
+          detailId,
+          provider,
+          model,
+          connectionId: conn.id,
+          bodyBuffer
+        });
+        fetch("http://127.0.0.1:20128/api/internal/request-detail", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            [INTERNAL_REQUEST_HEADER.name]: INTERNAL_REQUEST_HEADER.value
+          },
+          body: JSON.stringify(inputOnlyDetail)
+        }).catch((detailError) => {
+          err(`[token-swap] failed to create request detail for "${label}": ${detailError.message}`);
+        });
+
+        const usageObserver = createTokenSwapUsageObserver({
+          provider,
+          model,
+          connectionId: conn.id,
+          accountLabel: label,
+          bodyBuffer,
+          contentType: result.response.headers["content-type"] || "",
+          contentEncoding: result.response.headers["content-encoding"] || "",
+          statusCode,
+          detailRecord: inputOnlyDetail,
+          requestStartTime
+        });
+
+        result.response.on("data", (chunk) => {
+          usageObserver.onChunk(chunk);
+          res.write(chunk);
+        });
+        result.response.on("end", () => {
+          res.end();
+          usageObserver.onEnd().catch(() => {});
+        });
+        result.response.on("error", (streamError) => {
+          err(`[token-swap] upstream stream error for "${label}": ${streamError.message}`);
+          if (!res.writableEnded) res.end();
+        });
+        return true;
+      } catch (e) {
+        err(`[token-swap] error for "${label}": ${e.message}`);
+        break;
+      }
     }
   }
 
@@ -308,6 +332,36 @@ async function tokenSwapForward(req, res, bodyBuffer, connections, model, strate
   return false;
 }
 
+function getHeaderValue(headers, name) {
+  const value = headers?.[String(name).toLowerCase()];
+  if (Array.isArray(value)) return value.join(", ");
+  return typeof value === "string" ? value : "";
+}
+
+function isRetryableAuthFailure(statusCode, headers, body) {
+  if (statusCode !== 401) return false;
+
+  const authHeader = getHeaderValue(headers, "www-authenticate").toLowerCase();
+  if (authHeader.includes("invalid_token")) return true;
+
+  try {
+    const parsed = JSON.parse(body || "{}");
+    const status = String(parsed?.error?.status || parsed?.status || "").toUpperCase();
+    const message = String(parsed?.error?.message || parsed?.message || "").toLowerCase();
+    if (status === "UNAUTHENTICATED") return true;
+    if (message.includes("invalid authentication credentials")) return true;
+    if (message.includes("invalid token")) return true;
+    if (message.includes("unauthenticated")) return true;
+  } catch {
+    const fallback = String(body || "").toLowerCase();
+    if (fallback.includes("invalid authentication credentials")) return true;
+    if (fallback.includes("invalid token")) return true;
+    if (fallback.includes("unauthenticated")) return true;
+  }
+
+  return false;
+}
+
 // ── Request handler ───────────────────────────────────────────
 
 const server = https.createServer(sslOptions, async (req, res) => {

package/.next/standalone/mitm/tokenPool.js

@@ -14,6 +14,7 @@ const DB_FILE = path.join(DATA_DIR, "db.json");
 const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000; // refresh 5min before expiry
 const ROUTER_PORT = process.env.PORT || 20128;
 const DEFAULT_COOLDOWN_MS = 5 * 60 * 1000;
+const DEFAULT_AUTH_COOLDOWN_MS = 10 * 60 * 1000;
 
 // ── In-memory state ──────────────────────────────────────────
 const cooldownMap = {};        // { [connectionId]: expiresTimestamp }
@@ -28,6 +29,12 @@ function setCooldown(connId, durationMs) {
   log(`⏸ [token-pool] cooldown: ${connId.slice(0, 8)}… for ${Math.ceil(ms / 60000)}m`);
 }
 
+function setAuthCooldown(connId, durationMs) {
+  const ms = durationMs || DEFAULT_AUTH_COOLDOWN_MS;
+  cooldownMap[connId] = Date.now() + ms;
+  log(`🔒 [token-pool] auth-cooldown: ${connId.slice(0, 8)}… for ${Math.ceil(ms / 60000)}m`);
+}
+
 function isInCooldown(connId) {
   if (!cooldownMap[connId]) return false;
   if (Date.now() > cooldownMap[connId]) {
@@ -287,41 +294,82 @@ function markAccountUsed(connId) {
 // checks expiry, refreshes token automatically, then returns the
 // latest persisted connection snapshot for the current request.
 
-async function triggerRefreshIfNeeded(connection) {
-  if (!connection?.expiresAt || !connection?.refreshToken) return connection;
-  const expiresAt = new Date(connection.expiresAt).getTime();
-  if (Date.now() + TOKEN_EXPIRY_BUFFER_MS < expiresAt) return connection;
-
-  log(`🔄 [token-pool] near-expiry refresh → ${getConnectionLabel(connection).slice(0, 20)}`);
+async function runConnectionTest(connection) {
   return await new Promise((resolve) => {
+    if (!connection?.id) {
+      resolve({ connection, refreshed: false, valid: false });
+      return;
+    }
+
+    let responseBody = "";
+
     try {
       const req = http.request(
         { hostname: "127.0.0.1", port: ROUTER_PORT, path: `/api/providers/${connection.id}/test`, method: "POST" },
         (res) => {
-          res.on("data", () => {});
+          res.on("data", (chunk) => {
+            responseBody += chunk.toString();
+          });
           res.on("end", () => {
-            const refreshed = getConnectionById(connection.id);
-            if (refreshed?.accessToken && refreshed.accessToken !== connection.accessToken) {
-              log(`♻️ [token-pool] refreshed token applied → ${getConnectionLabel(connection).slice(0, 20)}`);
+            let payload = {};
+            try {
+              payload = JSON.parse(responseBody || "{}");
+            } catch {
+              payload = {};
             }
-            resolve(refreshed || connection);
+
+            const refreshedConnection = getConnectionById(connection.id);
+            const tokenChanged = !!(refreshedConnection?.accessToken && refreshedConnection.accessToken !== connection.accessToken);
+            resolve({
+              connection: refreshedConnection || connection,
+              refreshed: !!payload.refreshed || tokenChanged,
+              valid: !!payload.valid,
+            });
           });
         }
       );
-      req.on("error", () => resolve(connection));
+      req.on("error", () => resolve({ connection, refreshed: false, valid: false }));
       req.end();
     } catch {
-      resolve(connection);
+      resolve({ connection, refreshed: false, valid: false });
     }
   });
 }
 
+async function triggerRefreshIfNeeded(connection) {
+  if (!connection?.expiresAt || !connection?.refreshToken) return connection;
+  const expiresAt = new Date(connection.expiresAt).getTime();
+  if (Date.now() + TOKEN_EXPIRY_BUFFER_MS < expiresAt) return connection;
+
+  log(`🔄 [token-pool] near-expiry refresh → ${getConnectionLabel(connection).slice(0, 20)}`);
+  const result = await runConnectionTest(connection);
+  if (result.refreshed) {
+    log(`♻️ [token-pool] refreshed token applied → ${getConnectionLabel(connection).slice(0, 20)}`);
+  }
+  return result.connection || connection;
+}
+
+async function forceRefreshConnection(connection) {
+  if (!connection?.refreshToken) {
+    return { connection, refreshed: false, valid: false };
+  }
+
+  log(`🔄 [token-pool] auth refresh → ${getConnectionLabel(connection).slice(0, 20)}`);
+  const result = await runConnectionTest(connection);
+  if (result.refreshed) {
+    log(`♻️ [token-pool] refreshed token applied → ${getConnectionLabel(connection).slice(0, 20)}`);
+  }
+  return result;
+}
+
 module.exports = {
   isTokenSwapEnabled,
   getNextConnection,
   getAllActiveConnections,
   triggerRefreshIfNeeded,
+  forceRefreshConnection,
   setCooldown,
+  setAuthCooldown,
   setModelCooldown,
   isModelExhausted,
   getTokenSwapStrategy,

package/.next/standalone/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "n9router",
-  "version": "0.3.91",
+  "version": "0.3.94",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "n9router",
-      "version": "0.3.91",
+      "version": "0.3.94",
       "license": "MIT",
       "dependencies": {
         "@monaco-editor/react": "^4.7.0",

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n9router",
-  "version": "0.3.91",
+  "version": "0.3.94",
   "description": "Self-hosted AI routing gateway — local proxy for Claude, Gemini, OpenAI and 40+ providers",
   "keywords": [
     "ai",